At the training phase (illustrated in the left of Fig. REF ), we also minimize the empirical risk of the perturbed data \(x_p\)  to ensure that the generator persists enough information to predict the original label \(y\)  with KL divergence [1]}. The objective is,
\(\small \max _G M(\phi (G(x)), \phi (x)) - KL(\theta (\phi (G(x))), y).\) 
